[BUG] WARNING in workingset_activation triggered by KVM page fault path on Linux 7.0.0-08391-g1d51b370a0f8

[BUG] WARNING in workingset_activation triggered by KVM page fault path on Linux 7.0.0-08391-g1d51b370a0f8

[Zw Tang]

Hi,

I am reporting a WARNING in workingset_activation() triggered by a
syzkaller C reproducer on Linux 7.0.0-08391-g1d51b370a0f8.

The warning is hit from the KVM page fault path:
kvm_set_page_accessed() -> folio_mark_accessed() -> workingset_activation().

At first glance this looks more like an MM/workingset issue than a
KVM-specific bug, although KVM/SVM is the trigger path.

Reproducer:
C reproducer: pastebin.com/raw/zzNSd9HK
console output: pastebin.com/raw/TuipfpyA
kernel config: pastebin.com/raw/aq1V3cLk

Kernel:
HEAD commit: 1d51b370a0f8
git tree: torvalds/linux
kernel version: 7.0.0-08391-g1d51b370a0f8 #1 PREEMPT(lazy) (QEMU
Standard PC, Q35)

The warning is:

WARNING in workingset_activation

Log excerpt:

WARNING: include/linux/memcontrol.h:381 at
workingset_activation+0x466/0x540, CPU#1: repro/238

Call Trace:
folio_mark_accessed+0x1d3/0x650
kvm_set_page_accessed+0x5a/0x70
kvm_release_page_clean+0x26/0x180
direct_page_fault+0x553/0x11a0
kvm_mmu_page_fault+0x35b/0x2020
kvm_handle_page_fault+0x1aa/0x380
svm_invoke_exit_handler+0x7a/0xe0
svm_handle_exit+0x416/0x7f0
vcpu_enter_guest+0x26ad/0x49c0
kvm_arch_vcpu_ioctl_run+0x697/0x25e0
kvm_vcpu_ioctl+0x737/0x1610
__x64_sys_ioctl+0x192/0x220
do_syscall_64+0x117/0xfc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53

The reproducer appears to drive KVM into a guest page fault flow that
marks a folio as accessed, and the warning is then emitted inside
workingset_activation().

Because the RIP is in workingset_activation() itself, this may
indicate a problem in workingset/LRU or memcg/lruvec handling, with
KVM only serving as the trigger path.

Please let me know if I should also send this to additional KVM x86
maintainers, but mm/workingset.c seems to be the primary fault
location.

Thanks.